Privacy Policy

Last updated: 9 October 2026

1. Controller

Khashayar Voshmgir
Rechte Wienzeile 25-27/1/17, 1040 Wien, Austria
Email: vox@azvza.com
Phone: +43 699 13570707

This policy explains what personal data is processed when you visit this website, book a conversation, or when I contact you on LinkedIn, on what legal basis, and what rights you have. It is based on the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

2. Hosting and Cloudflare

This website is hosted and delivered by Cloudflare (Cloudflare Pages, DNS and protection against attacks). Cloudflare processes technical data your browser transmits, such as IP address, date and time, page requested, referrer and browser type.

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, certified under the EU-US Data Privacy Framework.

Legal basis: legitimate interest in the secure and stable operation of the website (Art. 6 (1) f GDPR). Retention: I have no access to individual server logs; Cloudflare's privacy policy applies (cloudflare.com/privacypolicy).

3. Web analytics

This website uses Cloudflare Web Analytics. It sets no cookies and only produces aggregated visitor statistics. No personal profile is created.

Legal basis: legitimate interest in understanding how the website is used (Art. 6 (1) f GDPR).

4. Cookies and consent

The tools in this section set cookies. They are loaded only after you agree in the cookie banner, except in the case described in the next paragraph. Without them, the website works the same.

Depending on the country you visit from, the tools may load without the banner. You can switch them off at any time under “Cookie settings”. If your browser sends a Global Privacy Control signal, the marketing tools stay off. Legal basis in that case: legitimate interest in measuring and marketing this website (Art. 6 (1) f GDPR); you can object at any time with the same switch. To tell whether to show the banner, your browser asks Cloudflare (section 2) for the country of your IP address. The country is kept in your browser for the current session only and is not stored by me.

With the tools you allowed, two moments are counted: a click on “Book a call” and a completed booking (Google Analytics, Microsoft Clarity, Meta, LinkedIn and X). Your name, email address and the content of the booking are not passed to them.

Legal basis: your consent (Art. 6 (1) a GDPR, § 165 (3) TKG 2021). You can change or withdraw it at any time with effect for the future, under “Cookie settings” at the bottom of every page or here: Cookie settings. When you withdraw, the cookies of these tools on this website are deleted.

Your choice itself is stored in your browser (local storage) for 12 months, so that the banner does not appear on every page. This storage is technically necessary and contains no profile.

4.1 Google Analytics (statistics)

Purpose: to see which pages are read, how visitors arrive and how long they stay, so that I can improve the website. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Google processes it on my behalf under a data processing agreement.

Data processed: pages visited, time, referrer, browser and device information, and an approximate location derived from the IP address. Google Analytics does not store the IP address. Google signals and ad personalisation are switched off. Cookies: _ga and _ga_* (up to 2 years). Retention in Google Analytics: event data up to 2 months, data linked to a visitor identifier up to 14 months.

4.2 Microsoft Clarity (statistics)

Purpose: to see how pages are used, through heatmaps and recordings of mouse movements, clicks and scrolling, so that I can improve the website. Text you type is masked and not recorded. Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-US Data Privacy Framework.

Data processed: pages visited, interactions on the page, time, referrer, browser and device information, and an approximate location derived from the IP address. Cookies: _clck (1 year) and _clsk (1 day). Advertising use is switched off. Microsoft's privacy statement applies (privacy.microsoft.com).

4.3 Meta Pixel (marketing)

Purpose: to show my ads on Facebook and Instagram to people who have visited this website, and to measure whether the ads work. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework.

Data processed: pages visited, time, IP address, browser and device information, and an identifier in the cookie _fbp (90 days). Page visits and clicks on “Book a call” are also sent from this website's server to Meta (Conversions API), with your IP address and browser information, so that they count even when a browser blocks the Pixel. If you are logged in to Facebook or Instagram, Meta can link the visit to your account. For collecting and transmitting this data, Meta and I are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum (facebook.com/legal/controller_addendum). Further processing is Meta's responsibility under its privacy policy (facebook.com/privacy/policy).

4.4 LinkedIn Insight Tag (marketing)

Purpose: to show my ads on LinkedIn to people who have visited this website, to measure the ads, and to receive statistics about visitors in aggregate form (for example job function or industry, never individual names). Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Data may be transferred to LinkedIn Corporation in the USA, which is certified under the EU-US Data Privacy Framework.

Data processed: page visited, time, referrer, IP address, browser and device information, and cookies set by LinkedIn (up to 1 year). LinkedIn pseudonymises direct identifiers within 7 days and deletes the remaining data within 180 days. For collecting and transmitting this data, LinkedIn and I are joint controllers (Art. 26 GDPR) under LinkedIn's Joint Controller Addendum. Further processing is LinkedIn's responsibility under its privacy policy (linkedin.com/legal/privacy-policy).

4.5 X Pixel (marketing)

Purpose: to show my ads on X to people who have visited this website, and to measure whether the ads work. Provider: Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Data may be transferred to X Corp. in the USA.

Data processed: pages visited, time, referrer, IP address, browser and device information, and cookies set by X (up to 2 years). If you are logged in to X, X can link the visit to your account. For collecting and transmitting this data, X and I are joint controllers (Art. 26 GDPR). Further processing is X's responsibility under its privacy policy (x.com/privacy).

5. Booking a conversation

Bookings are handled by TidyCal (Sumo Group, Inc., Austin, Texas, USA), based on the EU standard contractual clauses (Art. 46 (2) c GDPR). TidyCal processes the data you enter there, such as name, email address and chosen time, and passes it to me. The booking calendars are embedded on xerxes.re/call and xerxes.re/speaking/call and load from TidyCal when you open one of these pages. TidyCal's privacy policy applies: tidycal.com/privacy.

Legal basis: preparation of a contract at your request (Art. 6 (1) b GDPR). Retention: up to 6 months after our last exchange, unless a client relationship follows.

6. Email and calendar

If you contact me or we agree an appointment, I process the data you provide, using Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing also in the USA, certified under the EU-US Data Privacy Framework).

Legal basis: preparation or performance of a contract (Art. 6 (1) b GDPR), or legitimate interest in answering enquiries (Art. 6 (1) f GDPR). Retention: as long as needed for your request, then for statutory retention periods where applicable.

7. Clients

If we work together, the engagement terms you receive before the first session set out what data is processed, with which tools and for how long.

8. Recipients

Personal data is shared only with the providers named in this policy, including Notion for LinkedIn contacts (section 11), each of whom processes it on my behalf under a data processing agreement, and with authorities where the law requires it. Data is not sold. It is shared for advertising only with the marketing tools in section 4, as described there.

9. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time with effect for the future.

To exercise these rights, write to vox@azvza.com.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, dsb.gv.at.

10. Changes

This policy is updated when the tools or processes on this website change. The date at the top shows the current version.

11. Contacting you on LinkedIn

If I contact you on LinkedIn first, I use data you have made public there: your name, profile link, role, company and public posts. Purpose: to contact you about my services. Legal basis: legitimate interest (Art. 6 (1) f GDPR).

Storage: Notion (Notion Labs, Inc., San Francisco, California, USA), certified under the EU-US Data Privacy Framework.

Retention: if you do not reply, your data is deleted 12 months after my last message. If we start a conversation, sections 5 to 7 apply.

Right to object: you can object at any time by replying "stop" on LinkedIn or by email (section 1). I then keep only your name and profile link, so that you are not contacted again.